Georgia. Comprehensive data protection. Act
PDP Law 2023Law of Georgia on Personal Data Protection (No. 3144-XIმს-Xმპ of 14 June 2023)
Partly verified
Medium confidence.Maximum fine levels not verified. Independence concerns raised over the move to the State Audit Office.
§1Summary
- Synopsis
Georgia's GDPR-aligned law replacing the 2011 Act, introducing DPOs, DPIAs, breach notification, a special representative for foreign controllers and higher fines. Supervision moved in March 2026 from the Personal Data Protection Service to the State Audit Office.
- Key themes
- Unique features
Territorial trigger based on use of technical means in Georgia; sector-based DPO mandate (banks, insurers, telcos, airlines, medical); foreign controllers need a registered representative unless based in the EU or an EU-adequate state.
- SaaS relevance
Caught where a SaaS provider uses technical means in Georgia; representative needed for non-EU/non-adequate providers.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- State Audit Office within 72h; individuals without undue delay if significant harm
- DPO
- Conditional
- Cross-border transfers
- Adequacy/agreements/SCCs/authority permission
§3Dates
- Key dates
- Adopted
- In force
- Main provisions in force 2024-03-01 (DPO provisions phased later in 2024); Personal Data Protection Service abolished and functions transferred to the State Audit Office 2026-03-02 (amendment adopted 2025-12-17)
§4Text and authority
- Text
- Authoritative text matsne.gov.ge
- English text matsne.gov.ge
- Authority
- State Audit Office of Georgia (since 2 March 2026; previously Personal Data Protection Service)
§5Where it applies
- Domestic law of
- Georgia
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Maximum fine levels not verified. Independence concerns raised over the move to the State Audit Office.